Hello,
I have a question on a conditional find and replace. I have a query that calculates a mean for the different hours on the different days. This query looks like this:
index=index1 adapter_name=ABSAdapter earliest=-90d
| timechart span="1h" sum(number_of_records) as aantal
| eval time=strftime(_time,"%w%H")
| eventstats mean(aantal) as meanAantal, stdev(aantal) as stdAantal by time
| where (aantal>(meanAantal + (stdAantal * -3)) AND aantal<(meanAantal + (stdAantal * 3)))
| stats mean(aantal) as threshold by time
| eventstats mean(threshold) as overalMean
| table threshold, time, overalMean
Now I also want to find and replace threshold values that are under a certain value to 0. The condition should be something like:
if(threshold < overalMean*0.20) --> threshold = 0
else --> threshold = threshold
Does anyone know how to do this?
Thanks in advance and kind regards,
Willem
